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3. FEE FOR FILING APPEAL BRIEF 

Pursuant to 37 C.F .R. § 4 1 .20(b)(2), the fee for filing the Appeal Brief is: 

other than a small entity S500.00 
Appeal Brief fee due S500.00 

4. EXTENSION OF TERM 

The proceedings herem are for a patent application and the provisions of 37 C.F.R. § 1.136 ^ply. 

Applicant petitions for an extension of time under 37 C.F.R. § 1.136 (fees: 37 C.F,R. § 
Ll7(a)(l)-(5)) for two months: 

Fee: $450,00 

If an additional extension of time is required, please consider this a petition therefor. 

Applicant believes that no extension of term is required. However, this conditional petition is being 
made to provide for the possibility that ^plicant has madvertently overlooked 4e need for a 
petition and fee for extension of time. 

5. TOTAL FEE DUE 
The total fee due is: 

Appeal brief fee $500.00 

Extension fee (if any) $450.00 

TOTAJL FEE DUE $950.00 

6. FEE PAYMENT 

Authori2:atiQn is her^y made to charge the amount of $950.00 to Deposit Account No. 50-1351 
(Order No. NAI1P459). 
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IN THE UNITED STATES PATENT AND mAPEMARK OFFICE 
In re application of: 
Wolff etal. 

Application No. 09/854,492 
Filed: May 15,2001 

For: EVENT REPORTING BETWEEN A 
REPORTING COMPUTER AND A 
RECEIVING COMPUTER 



Group Art Unit: 2137 
Examiner: Py2»cha, Michael J. 
Date: November 13, 2006 



Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

ATTENTION: Board of Patent Appeals and Interferences 

APPEAL BRIEF (37 C.F.R. § 4137) 

This brief is in furtherance of the Notice of Appeal, filed in this case on 07/1 1/2006, and the Notice 
of Panel Decision from Pre-Appeal Brief Review mailed 08/14/06. 

The fees reqvdred under §1.17, and any required petition for extension of time for filing this brief 
and fees therefor, are dealt with in the accompanying TRANSMITTAL OF APPEAL BRIEF. 



This brief contains these items under the following headings, and in the order set forth below (37 
C.F,R,§41.37(c)(i)): 



I REAL PARTY IN INTEREST 

II RELATED APPEALS AND INTERFERENCES 

III STATUS OF CLAIMS 

IV STATUS OF AMENDMENTS 

V SUMMARY OF CLAIMED SUBJECT MATTER 

VI GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 
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Vn ARGUMENT 

Vni CLAIMS APPENDIX 

DC EVIDENCE APPENDK 

X RELAHED PROCEEDING APPENDIX 

The final page of this brief beats the practitioner's signature. 
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I REAL PARTY IN INTEREST (37 C.F Jl- § 41.37(c)(l){i)) 
The real party in interest in this appeal is McAfee, Inc. 
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n RELATED APPEALS AND INTERFERENCES (37 C.F.R- § 41.37(c) (l)(ii)) 

With respect to other prior or pending appeals, interferences, or related judicial proceedings that 
will directly affect, or be directly affected by, or have a bearing on the Board's decision in the 
pending appeal, there are no other such appeals, int«ferences, or related judicial proceedings. 
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m STATUS OF CLAIMS (37 CJF.R. § 4137(c) (l)(iii)) 

A. TOTAL NUMBER OF CLAIMS IN APPLICATION 

Claims in the appUcalion are: 1-6, 8-17, 19-28, 30-39, 41-50, 52-61, and 63-74 

B. STATUS OF ALL THE CLAIMS IN APPLICATION 

1 . Claims withdrawn from consideration: None 

2. Claims pending: 1-6, 8-17, 19-28. 30-39, 41-50, 52-61, and 63-74 

3 . Claims allowed: None 

4. Claims rejected: 1-6, 8-17, 19-28, 30-39, 41-50, 52-61, and 63-74 

5 . Claims cancelled: 7, 1 8, 29, 40, 5 1 , and 62 

C. CLAIMS ON APPEAL 

The claims on appeal are: 1-6, 8-17, 19-28, 30-39, 41-50. 52-61, and 63-74 
See additional status information in the App^dix of Claims, 
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rv STATUS OF AMENDMENTS (37 C,F.R. § 41.37(c)(l)(iv)) 

As to the status of any amendment filed subsequent to final rejection, there are no such 
amendmeDts after final. 
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V SUMMARY OF CLAIMED SUBJECT MATTER (37 C.F.R. § 41.37(c)(l)(v)) 

With respect to a summary of Claim 1, as shown in Figures 1 and 2, a computer program product 
is provided which comprises a computer program operable to control a reporting computer to 
report the occurrence of an event to a receiving computer is provided. In use, report generating 
logic is operable to generate report data (e.g. see item 26 of Figure 2, etc.) identifying the 
reporting computer (e.g, see item 2 of Figure 1, etc.) and the event. Further, data retrieving logic 
is operable to fetch requested data from the receiving computer (e.g. see item 6 of Figure 1, etc.) 
to the reporting computer upon a request of the reporting computer. In addition, report sending 
logic is operable to send the report data (e.g. see item 26 of Figure 2, etc) from the reporting 
computer (e.g. see item 2 of Figure 1, etc.) to the receiving computer (e.g. see item 6 of Figure 1, 
etcO during the fetch of the requested data. The data retrievmg logic and the report sendmg logic 
use an internet URL (e.g, see item 20 of Figure 2, etc.) to specify the requested data to the 
receiving computer. The mtemet URL specifying the requested data also contains the report data 
(e.g. see item 26 of Figure 2, etc.) to be sent to the receiving computer. See, for example, page 5, 
line 30 - page 7, line 28 et al. 

With respect to a summary of Claim 12, as shown in Figures 1 and 2, a computer program 
product is provided which comprises a computer program operable to control a receiving 
computer to receive a report of an occurrence of an event from a reporting computer. In use, 
data request receiving logic i$ operable to receive a request for requested data from the reporting 
computer (e.g. see item 2 of Figure 1, etc.). Further, data providing logic is operable to provide 
the requested data to the reporting computer (e.g. see item 2 of Figure 1, etc.). In addition, report 
receiving logic is operable to receive report data (e.g. see item 26 of Figure 2, etc.) identifying 
the reporting computer (e.g, see item 2 of Figure 1, etc.) and the event from the reporting 
computer during the providing of the requested data to the reporting computer. The data 
retrieving logic and the report sending logic use an internet URL (e.g. see item 20 of Figure 2, 
etc.) to specify the requested data to the receiving computer (e.g. see item 6 of Figure 1, etc.). 
The internet URL specifying the requested data also contains the report data (e.g. see item 26 of 
Figure 2, etc.) to be sent to the receiving computer (e.g. see item 6 of Figure 1, etc.). See, for 
example, page 5, line 30 - page 7, line 28 et al. 
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With respect to a summary of Claim 23, as shown in Figures 1 and 2, a method of controlling a 
reporting computer to report an occurrence of an event to a receiving comptiter is provided. In 
xise, report data (e.g. see item 26 of Figure 2, etc.) identifying the reporting computer (e.g. see 
item 2 of Figure U etc.) and the event is generated. Further, requested data is fetched from the 
receiving computer (e.g. see item 6 of Figure 1, etc.) to the reporting computer upon a request of 
the reporting computer, In addition, the report data (e.g. see item 26 of Figxire 2, etc.) is sent 
from the reporting computer to the receiving computer during fetching of the requested data. An 
mtemet URL (e.g. see item 20 of Figure 2, etc.) is used to specify the requested data to the 
receiving computer. The internet URL specifying the requested data also contains the report data 
(e.g. see item 26 of Figure 2, etc.) to be sent to the receiving computer. See, for example, page 5, 
line 30 - page 7, line 28 et al. 

With respect to a suntunary of Claim 34, as shown in Figures 1 and 2, a method of controUing a 
receiving computer to receive a report of an occurrence of an event from a reporting computer is 
provided. In use, a request for requested data is received from the reporting computer (e.g. see 
itern 2 of Figure 1, etc.)- Further, the requested data is provided to the reporting computer. In 
addition, report data (e.g. see item 26 of Figure 2, etc.) is received that identifies the reporting 
computer and the event from the reporting computer during providing of the requested data to 
the reporting computer. An internet URL (e.g. see item 20 of Figure 2, etc.) is used to specify 
the requested data to the receiving computer (e.g. see item 6 of Figure 1 , etc.). The internet URL 
specifying the requested data also contains the report data (e.g, see item 26 of Figure 2, etc.) to 
be sent to the receiving computer. See, for example, page 5, line 30 - page 7, Une 28 et al. 

With respect to a summary of Claim 45> as shown in Figures 1 and 2, a reporting computer 
operable to report occurrence of an event to a receiving computer is provided. In use, a report 
generator is operable to generate report data (e.g. see item 26 of Figure 2, etc.) identifying the 
reporting computer (e.g. see item 2 of Figure 1, etc.) and the event, Fxuther, a data retriever is 
operable to fetch requested data from the receiving computer (e.g. see item 6 of Figure 1, etc.) to 
the reporting computer upon a request of the reporting computer. In addition, a report sender is 
operable to send the report data (e.g, see item 26 of Figure 2, etc.) from the reporting computer to 
the receiving computer during the fetch of the requested data. An internet URL (e.g. see item 20 
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of Figure 2, etc) is used to specify the requested data to the receiving computer. The internet 
URL specifying the requested data also contains the report data (e.g. see item 26 of Figure 2, 
etc.) to be sent to the receiving computer (see, for example, page 5, line 30 - page 7, line 28 et 
al.). 

With respect to a sunraiary of Claim 56, as shown in Figures 1 and 2, a receiving computer 
operable to receive a report of occurrence of an event from a rqportmg computer is provided. In 
use, a data request receiver is operable to receive a request for requested data from the reporting 
computer (e,g. see item 2 of Figure 1, etc.). Further, a data provider is operable to provide the 
requested data to the reporting computer. In addition, a report receiver is operable to receive 
report data (e.g. see item 26 of Figure 2, etc.) identifying the reporting computer and the event 
from the reporting computer during providing of the requested data to the reporting computer. 
An internet URL (e.g. see item 20 of Figure 2, etc.) is used to specify the requested data to the 
receiving computer (e,g. see item 6 of Figure 1 , etc.). The internet URL specifying the requested 
data also contains Ae report data (e.g. see item 26 of Figure 2, etc.) to be sent to the receiving 
computer. See, for example, page 5, line 30 - page 7, line 28 et al. 
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VI GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL (37 C.F.R- § 
4137(c)(l)(vi)) 

Following, under each issue listed, is a concise Sftatement setting forth the corresponding ground 
of rejection. 

Issue # 1: The Examiner has rejected Claims 1-6, 8, 10-17, 19, 21-28, 30, 32-39, 41, 43-50, 52, 
54-61, 63, 65-66, and 72-74 under 35 U.S.C. 103(a) as being unpatentable over Symantec 
("Symantec System Center Implementation Guide"), in view of Chen et al. (U.S. Patent No. 
5,960,170), in view of Brown (''Data Communications*'), and further in view of Graham CTJRLs 
for HTTP Servers'O. 

Issue # 2: The Examiner has rejected Claims 9, 20, 31, 42, 53, and 64 under 35 U.S.C. 103(a) as 
being unpatentable over Symantec ("Symantec System Center Implementation Guide'0> view 
of Chen et al. (U.S. Patent No. 5,960,170), in view of Brown CT>ata Communications"), in view 
of Graham ("URLs for HTTP Servers"), and further in view of Menezes et al. ("Handbook of 
Applied Cryptography"). 

Issue # 3: The Examiner has rejected Claim 67 under 35 U.S.C. 103(a) as being unpatentable 
over Symantec ("Symantec System Centw Implementation Guide'*), in view of Chen et al. (U.S. 
Patent No. 5,960,170), in view of Brown ("Data Communications"), in view of Graham ("URLs 
for HTTP Servers"), in view of Norton ("Norton Antivirus Corporate Edition Implementation 
Guide"), and further in view of Grundy (U.S. Patent No. 5,291,598). 

Issue # 4: The Examiner has rejected Claims 68-69 under 35 U.S.C 103(a) as being unpatentable 
over Symantec ("Symantec System Center Implementation Guide"), in view of Chen et al. (U.S. 
Patent No. 5,960,170), in view of Brown C^Data Communications"), in view of Graham C'URLs 
for HTTP Servers"), and fiirther in view of Williams (U.S. Publication No. 2002/0138435). 

Issue # 5: The Examiner has rejected Claims 70-71 under 35 U.S.C. 103(a) as being unpatentable 
over Symantec ("Symantec System Center Implementation Guide"), in view of Chen et al. (U.S. 
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Patent No. 5.960,170), in view of Brown ("Data Communications"), in view of Graham ("URLs 
for HTTP Servers'^, and ftirther in view of Cox (U.S. Patent No. 6,842,861). 
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VII ARGUMENT (37 C.F.R. § 4137(c)(l)(vU)) 

The cladms of the groups noted below do not stand or fall together. In the present section, 
appellant explains why the claims of each group are believed to be separately patentable. 

Issue # 1 : 

The Examiner has rejected Claims 1-6. 8, 10-17, 19. 21-28, 30. 32-39, 41, 43-50, 52. 54-61, 63, 
65-66, and 72-74 under 35 U.S.C. 103(a) as being unpatentable over Symantec ("Symanlec 
System Center Implementation Guide"), in view of Chen et al. (U.S. Patent No. 5,960,170), in 
view of Brown ("Data Communications"), and fiirther in view of Graham ("URLs for HTIT 
Servers"). 

Groi^ m: Claims 1-3, 10-14. 21-25. 32-36. 43-47. 54-38. 65-66. and 72-74 

With respect to independent Claims 1. 12, 23, 34, 45, and 56, the Examiner has relied on section 
8. 1 .1 in Graham to make a prior art showing of appellant's cleumed technique "wheiein said data 
retrieving logic and said report sending logic use an internet URL to specify said requested data 
to said receiving computer, said internet URL also containing said report data to be sent to said 
receiving computer" (see this or similar, but not necessarily identical language in the 
independent claims). 

Appellant respectfiilly asserts that such excerpt only teaches a URL that includes (1) the 
directory to a program/script and (2) the search parameters for the program/script to utilize when 
performing a search. Appellant emphasizes the URL example shown in section 8.1.1 as follows: 
http://some.site.edu/c£n-bin/foo?argl+arg2+arg3 . As shown in Graham, such URL only contains 
the directory (i.e. http;//some.site.edu/cgi-bin/foo) . and the parameters (i.e. argl+arg2+arg3). 
Appellant, on the other hand, claims that the "internet XJRL also contain[sl said report data to be 
sent to said receiving computer" (emphasis added), as claimed. Clearly, Graham's disclosed 
directory and parameters do not meet ^pellant's claimed report data, especially when read in 
context, namely that the "report data identif[ies] said reporting computer and said event" (see the 
independent claims), in the context as claimed by appellant. 
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In the Office Action mailed 04/1 1/2006, the Examiner has argued that "Graham is relied upon to 
show that a URL [m]a[y] send data and this daU is what is defined as the requested data in the 
combination of Symantec and Chen et al," 

In response, appellant respectfully asserts that the combination of Symantec, Chen, Brown and 
Graham et al. fails to disclose appellant's claimed **sending said report data from said reporting 
computer to said receiving computer during fetching of said requested data," 'Svherein an 
internet URL is used to specify said requested data to said receiving computer, said internet URL 
specifying said requested data also contaming said report data to be sent to said receiving 
computer," as claimed. 

Specifically, the Examiner has reUed upon Col. 7, lines 33-45 in Chen to make a prior art 
showing of appellant's claimed "sending said report data from said reporting computer to said 
receiving computer during fetching of said requested data," as claimed. 

Appellant respectfully asserts that Chen merely discloses that, "[a]fter receipt of the virus 
detection object, in step 220 the virus detection object is executed by the client 300 and in step 
225 the results of virus detection object execution are transmitted to the virus de tection server 
400 which receives the results and in step 230 produces an additional virus detection based upon 
the result of the execution of the first virus detection object*' (emphasis added). Clearly, Chen's 
disclosure that the additional virus detection object is produced based on the result of the 
execution (along with the disclosure of the remaining references) feils to even suggest ''sending 
said report data from said reporting computer to said receiving computer during fetc hing of said 
requested data " (emphasis added), as claimed by appellant. Since Chen discloses sending the 
result, and then receiving the additional virus detection, Chen fails to even suggest appellant* s 
claimed "sending said report data ... during fetching of said requested data" (emphasis added), 
as claimed. 

In addition, it appears that the Examiner has further reUed upon page 2 in Brown to make a prior 
art showing of appellant's claimed "sending said report data „, during fetching of said requested 
data," as claimed. 
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Appellant points out that page 2 of Brown discloses tiiat, with Full Duplex, "fdlata can travel in 
both directions simultaneously [and] [tjhere is no need to switch from transmit to receive mode 
like in half duplex" (emphasis added). However, page 1 of Brown discloses that "you can think 
of Internet surfing as being half-duplex, as a user issues a request for a web document, then that 
document is downloaded and displayed before the user issues another reottest" (emphasis 
added). Clearly, Brown's disclosure of Internet requests for a web document being half-duplex 
fails to meet and even teaches away from appeUant's claimed "sending said report data ... 
dming fetching of said requested data" (emphasis added), as claimed. 

To this end, even when the Examiner's proposed combination is taken into account in its 
entirety, the appellant's claim language is still not met, as noted above. Further, appellant 
respectfully asserts that it is improper to combine references v/bere the references teach away. In 
te Grasselli, 713 F.2d 731, 743. 218 USPQ 769, 779 (Fed. Cir. 1983). 

Still with respect to the independent claims, and particularly appellant's claimed technique 
"wherein said data retrieving logic and said report sending logic use on intemet URL to specify 
said requested data to said receiving computer, said intemet URL also containing said report data 
to be sent to said receiving computer" (see this or similar, but not necessarily identical language 
in the independent claims), appellant lespectfiilly asserts that Graham merely discloses that 
"[t]he HTTP protocol support(s] the passing of arguments to the server" where "[t]he general 
format is to poslpend the arguments to the URL, separated from the URL by a question mark 
(?)." 

However, merely passing arguments to the server by postpending the arguments to the URL 
(along with the disclosure of the remaming references), as in Graham, fails to even suggest a 
technique "wherein an intemet URL is used to specify said requested data to said receiving 
computer, said intemet URL specif ying said requested data also containing said report data to be 
sent to said receiving computer" (emphasis added), as claimed by appellant. 'Qearly, the mere 
disclosure that "these programs/scripts can in turn act on the arguments and retgrn infoimatioTi. 
documents, etc. to the browser" (emphasis added - along with the disclosure of the remaining 
references) fails to even suggest that "said requested data also contain[s] said report data." v^ere 
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the '"report data identif[tes] said reporting computer and said event " (emphasis added), as 
claimed by appellant. Again, when the Examiner's proposed combination is taken into account 
in its entirety, the claimed invention is still not met. 

To establish a prima facie case of obviousness, three basic criteria must be met First, there must 
be some suggestion or motivation, either in the references themselves or in the knowledge 
generally available to one of ordinary skill in the art, to modify the reference or to combine 
reference teachings. Second, there must be a reasonable expectation of success, Finally, the prior 
art reference (or references when combined) must teach or suggest all the claim limitations* The 
teaching or suggestion to make the claimed combination and the reasonable expectation of 
success must both be found in the prior art and not based on appellant's disclosure. In re 
Vaeck947 F.2d 488, 20 USPQ2d 1438 (Fed.Cir.1991). 

Appellant respectfully asserts that at least the first and third elements of the prima facie case of 
obviousness have not been met, as noted above. 

Group #2: Claims 4, 15, 26, S7, 48, and 59 

With lespect to Claims 4, 15, 26> 37, 48, and 59, the Examiner has relied on pages 13 and 18 in 
Symantec to make a prior art showing of appellant's claimed technique **wherein said requested 
data is a description of said event" 

Appellant respectfully asserts that such excerpts firom Symantec only teach that the Symantec 
System Center provides alerting, logging and data export and activating tasks^ and that virus 
update files and product updates can be retrieved fcom a master primary server. Clearly, such 
teachings do not even suggest a "description of said event" (emphasis added), as claimed by 
appellant. 

In the Office Action mailed 04/11/2006, the Examiner has argued that *the alert described on 
pages 13, 18, and 73 of Symantec clearly describe an event, by showitig when, where, and what 
happened." 
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Appellant respectfully asserts that page 73 of Symantec merely discloses an "Alert Log [which] 
displays a list of alerts with information about each alert: Alert Name, Source, Computer, Date, 
Time, Severity." However, merely listing information about the alert fails to even suggest a 
technique "wherein said requested data is a description of said event " (emphasis added), as 
claimed by appellant. 

Again, appellant respectfully asserts that at least the first and third elements of the prima facie 
case of obviousness have not been met, as noted above. 

Group #3: Claims 5, 16, 27, 38, 49, and 60 

With respect to Clauns 5, 16. 27, 38, 49. and 60. the Examiner has relied on pages 18 and 73 in 
Symantec to make a prior art showing of appellant's claimed technique "wherein said event is 
detection of a computer file containing a computer virus and said requested data is a description 
of said computer virus." 

First, appellant respectfully asserts that Symantec does not teach a description of a computer 
vunis, as claimed by e^jpellant, for Ae reasons noted above with respect to Issue #1, Group #2. 
Second, it seems the Examiner has attempted to show that Symantec discloses a detection of a 
computer virus, and that Symantec provides a description of a computer virus, without takmg 
into account Ae context of ^pcUant's claim language. In particular, appellant claims that "said 
event is detecUon of a computer file containing a computer virus and said requested data is a 
description of said computer virus" (emphasis added) M^liere, "report data identif[ies]...said 
event" in the manner as claimed by appellant (see the mdependent claims for context). 

Again, appellant respectfully asserts that at least the first and third elements of the priTrta facte 
case of obviousness have not been met. as noted above. 

Group §4: Claims 6, 17, 28, 39, 50, and 61 

With respect to Claims 6. 17, 28, 39, 50, and 61, the Examiner has agam relied on pages 18 and 
73 in Symantec to make a prior art showing of ^pellant's claimed technique "wherein said event 
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is detection of a computer file containing a cotnputer virus and said requested data is an updated 
set of computer virus detecting data for use in detecting computer viruses." For substantially the 
same reasons as argued above with respect to Issue #1, Group #3, appellant respectfully asserts 
that Symantec fails to teach appellant's specific claim language when read in context 

In the Office Action mailed 04/1 1/2006, the Examifter has argued that "Symantec is relied upon 
for its teaching of the report data with the teport data describing an event, by showing when, 
where, and what happened and Chen et al teaches sending the requested report data," 

Appellant respectfully asserts that Col. 7, lines 33-45 of Chen merely discloses that "results of 
virus detection object execution are transmitted to the virus detection server 400 which receives 
the results and in step 230 produces an additional virus detection based upon the result of the 
execution of the first virus detection object" (emphasis added). Clearly, the mere disclosure that 
the virus detection server produces an additional virus detection based upon the resxilt fails to 
even suggest that *'said requested data is an undated set of computer virus detecting data for use 
in detecting computer viruses" (see Claim 6 et al. - emphasis added), as claimed by appellant. 

Again, appellant respectfully asserts that at least the fu:st and third elements of the prima facie 
case of obviousness have not been met, as noted above. 

Growp #J; Claims 8, 19, 30, 41, 52, and 63 

With respect to Claims 8. 19. 30, 41, 52, aud 63, the Examiner has relied on the Figure on page 
73 of Symantec to make a prior art showing of appellant^s claimed technique 'Svherein said 
reporting computer collates report data specifying one or more events that is sent together from 
said reporting computer to said receiving computer during said fetch of said requested data." 

Appellant respectfiiUy asserts that such figure only shows a list of alerts. Clearly, a list of alerts 
that each show the type of event discovered and the computer fi-om which said event occurred 
does not meet all of appellant's claim language, namely that "said reporting computer collates 
report data specifying one or more events that is sent together fit>m said reporting computer to 
said receiving computer during said fetch of said requested data" (emphasis added), as claimed 
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by appellant. In fad, appellant notes that the log shown on page 73 of Symantec is associated 
with a specific server and that a copy is merely displayed when requested by a local console, but 
not that collated report data "is sent... during said fetch of said requested data," as claimed by 
appellant. 

In the Office Action mailed 04/11/2006, the Examiner has argued that "Symantec teaches 
generating a list of all alerts generated by the network computers" and that "[i]n combination 
these alerts were collected during the fetch of the requested data as taught by Chen et al," 
However, appellant respectfully asserts that Col 7, lines 33-45 in Chen merely discloses that the 
"vnus detection object is executed by the client 300 and in step 225 the results of virus detection 
object execution are transmitted to the virus detection server" (emphasis added). 

Clearly, transmitting results of the virus detection object execution, as in Chen, fails to even 
suggest that "said reporting computer collates report data specifying one or more events that is 
sent together fi-om said reporting computer to said receiving computer during said fetch of said 
requested data" (emphasis added), as claimed by appellant In addition, Symantec teaches that 
"[e]ach server stores its own copy of the Alert Log locally" and that "[w]hen you select a server 
an[d] view its alert log, you're actually retrieving a copy of that server's Alert Log to your local 
console" (emphasis added). Clearly, disclosing the server has a copy which is retrieved to the 
local console upon viewing, as in Chen, fails to even suggest that "said reporting computer 
collates, report data specifying one of more events that is sent together fiom said reporting 
computer to said recei ving computer daring said fetch of said requested data " (emphasis added), 
as claimed by appellant. 

Again, appellant respectfully asserts that at least the fu:st and third elements of the prima facie 
case of obviousness have not been met, as noted above. 

Issue #2: 

The Examiner has rejected Claims 9. 20, 31, 42, 53, and 64 under 35 U.S.C. 103(a) as being 
unpatentable over Symantec ("Symantec System Center Implementation Guide"), in view of 
Chen et al. (U.S. Patent No. 5,960,170), m view of Brown ('TData Communications"), in view of 
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Graham ("URLs for HTTP Servers'*) and further in view of Menezes et al. C'Handbook of 
Applied Cryptography"*), 

Group #i. Claims 9, 20. 31 42, 53, and 64 

Appellant respectfully asserts that such claims are not met by the prior art for the reasons argued 
above with respect to Issue #1, Group #1. 

Again, appellant respectfully asserts that at least the first and third elements of the prima facie 
case of obviousness have not been met, as noted above. 

Issue #3: 

The Examiner has rejected Claim 67 under 35 U.S.C. 103(a) as being unpatentable over 
Symantec ('^Symantec System Center Implementation Guide"), in view of Chen et al. (U.S. 
Patent No. 5,960,170), in view of Brown ("Data Communications"), in view of Graham ("URLs 
for HTTP Servers"), in view of Norton ("Norton Antivirus Corporate Edition Implementation 
Guide'*), and further in view of Grundy (U.S. Patent No. 5,291,598). 

Group #/. Claim 67 

With respect to Claim 67, the Examilier has relied on page 73 of the Symantec reference, in 
addition to pages 286-287 of the Norton reference, and Col. 18, lines 45-57 of the Grundy 
reference to tnake a prior art showing of appellant's claimed technique "wherein said report data 
includes: a MAC address identifying a network card of said reporting computer; a date of said 
event; a time of said event; an identifier of a computer program used by said reporting computer 
to detect said event; an identifier of a version of a computer program used by said reporting 
computer to detect said event; an identifier of a set of event detecting data used by a computer 
program used by said reporting computer to detect said even^ an identifier of an event type 
detected by said reporting computer; an action taken by said reporting computer upon detection 
of said event; and a checksum of a file that triggered said event." 
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Appellant respectfully asserts that the excerpt from Symantec relied upoo by the Examiner 
merely discloses that "[t]he Alert Log displays a list of alerts with this information about each 
alert: Alert Name, Source, Computer, Date, Time, [and] Severity." However, merely disclosing 
that the alert log lists information on each alert simply fails to even suggest a technique 'S;^erein 
said report data includes: a MAC address identifying a network card of said reporting computer; 
a date of said event; a time of said event; an identifier of a computer program used by said 
reporting computer to detect said event an identifier of a version of a comt>uter program used by 
said reporting computer to detect said event an identifier of a set of event detecting data used by 
a computer program used by said reporting compxrter to detect said event: an identifier of an 
event type detected by said reportit^g computer; an action taken by said reporting computer upon 
detection of said event; and a checksum of a file that triggered said event" (emphasis added), as 
claimed by appellant. 

Further, appellant respeotfially asserts that the excerpt from Norton cited by the Examiner metely 
discloses *Sdew[ing] virus activity and scanning on your network** as well as '"histories for 
selected server groups, for a single server group, or for selected computers within a server 
group." Further, Norton discloses that "[i]f you select a server group, Virus History Usts 
information about viruses, detected on all computers throughout the server group." In addition, 
Norton discloses a Virus History, which *'shows...the name and location of the infected file, the 
name of the infected computer, the primary and secondary actions that were configured for the 
detected virus, and what action was taken on the virus," a Virus Sweep History, a Scan History, 
and an Event Log, which "contains all other logged information that does not fell into the 
previous two categories... [such as] messages about virus definitions file or configuration 
changes for specific computers" (emphasis added). 

However, the mere disclosure of a Virus History, a Virus Sweep History, a Scan History, and an 
Event Log simply fail to disclose "an identifier of a version of a computer program used by said 
reporting computer to detect said event" as well as "an identifier of a set of event detectin g data 
used by a computer program used b v said reporting computer to detect said event" (emphasis 
added), as claimed by appellant. In addition, Norton's mei^ disclosure of an Event Log 
containing messages about virus definition files or configuration changes simply fails to suggest 
^'an identifier . . , used., . to detect said event,*' in the manner as claimed by appellant. 
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In addition, with respect to (he excerpt from Grundy relied upon by the Examiner, appellant 
respectfully asserts that Grundy merely teaches that "an anti-vinis checksum of the host software 
product is calculated " which is used "to ensure that the copy of the product being registered has 
not been corrupted in any way" (emphasis added). Clearly, the mere disclosure of calculating an 
anti-virus checksum to ensure that the product being registered is not corrupted simply fails to 
even suggest **a checksum of a file that triggered said evgnf * (emphasis added), as claimed by 
appellant. 

In addition* with respect to dependent Claim 61, the Examiner has dismissed the same under 
OfiQcial Notice. Specifically, the Examiner has stated that it would have been obvious for one of 
ordinary skill in the art at the time the invention was made to use a MAC address to identify the 
computer, and that motivation to do so would have been that MAC addresses provide a unique 
identity of a computer. Appellant respectfiilly disagrees. In particular, appellant respectfiilly 
asserts that a MAC address is generally utilized for identifying a network card . 

Appellant thus formally requests a specific showing of the subject matter in ALL of the claims in 
any future action. Note excerpt firom MPEP below. 

^'If the [appellant] traverses such an [OfGcial Notice^ assertion the examiner should cite a 
reference in support of his or her position." See MPEP 2144.03. 

With respect to the fiirst element of the prima facie case of obviousness and, in particular, the 
obviousness of combining the aforementioned references, the Examiner has argued that it would 
have been obvious to combine Norton and Grundy with the modified Symantec, Chen et al., 
Brown^ and Graham system because to do so would have enabled viewing the virus activity and 
scanning on the network and to make sure the file isn*t corrupt. To the contrary, appellant 
respectfully asserts that it would not have been obvious to combine the Norton and Grundy 
references with the modified Symantec, Chen et aL, Brown, and Graham system, especially in 
view of the vast evidence to the contrary. 
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For example, Grundy relates to a system for decentralized mamifecturing of copy-controlled 
software, wliile Chen relate to anti-virus scanners, Symantec relates to managing anti-virus 
scanners. Brown relates to half-duplex and M-duplex data communications, and Graham relates 
to URLs for HTT? servers. To simply glean features from a system for manufacturing copy- 
controlled software, such as that of Grundy, and combine the same with the non-analogous art of 
an anti-virus scanner, such as that of Chen, or the non-analogous art of managing anti-virus 
scanners, such as that of Symantec, would simply be improper. In particular, copy-controlled 
software generates registration codes, accepts and verifies authorization codes, and determines 
the operational mode of tide product, while anti-virus scanners detect and treat viruses. "In order 
to rely on a reference as a basis for rejection of an appellant's invention, the reference must 
either be in the field of appellant's endeavor or, if not, then be reasonably pertinent to the 
particular i»oblem with which the inventor was concemed." In re Oetiker, 977 F.2d 1443, 1446, 
24 USPQ2d 1443, 1445 (Fed. Cir. 1992). See also In re Deminski, 796 F.2d 436, 230 USPQ 313 
(Fed. Cir. 1986); In re Clay, 966 F.2d 656, 659, 23 USPQ2d 1058, 1060-61 (Fed. Cir. 1992). In 
view of the vastly different types of problems a copY-controUed softwarg manufacturing svstem 
addresses as opposed to anti-virus scannars the Examiner's proposed combination is 
inappropriate. 

Appellant respectfully asserts that at least the first and third elements of the prima facie case of 
obviousness have not been met, since it would be unobvious to combine the references, as noted 
above, and the prior art references, when combined, fail to teach or suggest M of the claim 
limitations, as noted above. 

Issue #4: 

The Examiner has rejected Claims 68-69 under 35 U.S.C. 103(a) as being unpatentable over 
Symantec ("Symantee System CentM Implementation Guide"), in view of Chen et al. (U.S. 
Patent No. 5,960,170), in view of Brown ("Data Communications"), in view of Graham ("URLs 
for HTEP Servers"), and further in view of Williams (U.S. Publication No. 2002/0138435). 

Group #] : Claims 68-69 
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Appellant respectfiilly asserts that such claims are not met by the prior art for the reasons argued 
above with respect to Issue #1, Group #1. 

Again, appellant respectfully asserts that at least the first and third elements of tibie prima facie 
case of obviousness have not been met, as noted above. 

Issue # 5: 

The Examiner has rejected Claims 70-71 under 35 U.S.C, 103(a) as being unpatentable over 
Symantec ("Symantec System Center Implementation Guide"), in view of Chen et al, (U.S. 
Patent No. 5,960,170), in view of Brown ("Data Communications")? ^ view of Graham (*TJRLs 
for HTTP Servers"), and further in view of Cox (U.S. Patent No. 6,842,861). 

Grovp #/; Claims 70 

With respect to Claim 70, the Examiner has telied on Col. 1, lines 21-39 of the Cox reference to 
make a prior art showing of appellant*s claimed technique ^Vherein said report data includes an 
identifier of a driver triggered during said event" 

Appellant respectfiilly asserts that the excerpt from Cox relied upon by the Examiner merely 
discloses that "[a] virus can infect ox become resident in almost any software component, 
including an application, operating system, system boot code, or device driver" (emphasis 
added). However, the mere disclosure that a virus can infect or become resident in a device 
driver simply fails to even suggest a technique "Svherein said report data inclxides an identifier of 
a driver triggered during said evenf ' (emphasis added), as claimed by appellant, or a technique 
"wherein said identifier of said driver is mapped to an identity of a virus that triggered said 
eyenf (emphasis added), as claimed by appellant Clearly, the excerpt from Cox fails to even 
suggest "an identifier of a driver triggered during an event,'* in the marmer as claimed by 
appellant. 

Again, appellant respectfully asserts that at least the first and third elements of the prima facie 
case of obviousness have not been met, as noted above. 
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Group #2: Claim 71 

With respect to Claim 70, the Examiner has relied oa Col 1, lines 21-39 of the Cox reference to 
make a prior art showing of appellant's claimed technique 'Svherein said identifier of said driver 
is mapped to an identity of a virus that triggered said event." 

Appellant respectfully asserts that the excerpt from Cox relied upon by the Examiner merely 
discloses that "[a] virus can infect, or become resident in almost any software component, 
including an application, operating system, system boot code, or device driver" ' (emphasis 
added). However, the mere disclosure that a virus can infect or become resident in a device 
driver simply fails to even suggest a technique 'Svherein said identifier of said driver is m^ped 
to an identity of a virus that triggered said event " (emphasis added), as claimed by appellant. 

Again, appellant respectfully asserts that at least the first and third elements of the prima facie 
case of obviousness have not been met, as noted above. 

In view of the remarks set forth hereinabove, all of the independent claims are deemed allowable, 
along with any claims depending therefrom. 
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Vni CLAIMS APPENDIX (37 C,F.R. § 4137(c)(l)(viii)) 

The text of the claims involved in the appeal (along with associated status infonuation) is set 
forth below: 

1. (previously presented) A compiJter program product comprising a computer program 
operable to control a reporting computer to report occurrence of an event to a receiving 
computer, said computer program comprising: 

report generating logic operable to generate report data identifying said reporting 
computer and said event; 

data retrieving logic operable to fetch requested data from said receiving computer to said 
reporting computer upon a request of said reporting con^uter; and 

report sending logic operable to sefid said report data from said reporting computer to 
said receiving computer during said fetch of said requested data; 

wherein said data retrieving logic and said report sending logic use an internet URL to 
specify said requested data to said receiving computer, said mtemet URL specifying said 
requested data also containing said report data to be sent to said receiving computer. 

2. (original) A computer program product as claimed in claim 1, wherein said event is 
detection of a computer file containing an unwanted computer program. 

3. (original) A computer program product as claimed in claim 2, wherein said unwanted 
computer program is a computer virus. 

4. (original) A computer program product as claimed in claim 1 j wherein said requested 
data is a description of said event 

5. (original) A computer program product as claimed in claim 1 , wherein said event is 
detection of a computer file containing a computer virus and said requested data is a description 
of said computer virus. 
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6. (originfll) A computer program product as claimed in claim 1 , wherein said event is 
detection of a compirter file containing a computer virus and said requested data is an updated set 
of computer virus detecting data for use in detecting computer viruses. 

7. (cancelled) 

8. (previously presented) A computer program product as claimed in claim 1 , wherein 
said reporting computer collates report data specifying one or more events that is sent together 
from said reporting computer to said receiving computer during said fetch of said requested data, 

9. (original) A computer program product as claimed in claim 1, wherein said report data 
is encrypted by said reporting computer and decrypted by said receiving computer. 

10. (original) A computer program product as claimed in claim 1, wherein said reporting 
computer and said receiving computer communicate via an internet link. 

1 1 . (original) A computer program product as claimed in claim 1, wherein said report 
data includes one or more of: 

a MAC address identifying a network card of said reporting computer; 
a date of said event; 
a time of said event; 

an identifier of a computer program used by said reporting computer to detect said event; 
an identifier of a version of a computer program used by said reporting computer to 
detect said event; 

an identifier of a set of event detecting data used by a computer program used by said 
reporting computer to detect said event; 

an identifier of an event type detected by said reporting con^)uter; 

an action taken by said reporting computer upon detection of said event; and 

a checksum of a file that triggered said event 
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12. (previously presented) A computer program product comprising a computer program 
operable to control a receiving computex to receive a report of occurrence of an event from a 
reporting computer, said computer program comprising: 

data request receiving logic operable to receive a request for requested data frcfm said 
reporting computer; 

data providiijg logic operable to provide said requested data to said reporting computer, 

and 

report receiving logic operable to receive report data identifying said reportiixg computer 
and said event &om said reporting computer during providing of said requested data to said 
reporting compxrter; 

wherein said data retrieving logic and said report sending logic use an internet URL to 
specify said requested data to said receiving computer, said internet URL specifying said 
requested data also containing said report data to be sent to said receiving computer. 

13. (original) A computer program product as claimed in claim 12, wherein said event is 
detection of a computer file containing an unwanted computer program. 

14. (original) A computer program product as claimed in claim 13, wherein said 
unwanted computer program is a computer virus. 

1 5. (original) A computer program product as claimed in claim 12, wherein said 
requested data is a description of said event. 

16. (original) A computer program product as claimed in claim 12, wherein said event is 
detection of a computer file containing a computer virus and said requested data is a description 
of said con^uter virus. 

17. (original) A computer program product as claimed in claim 12, wherem said event is 
detection of a computer file containing a computer virus and said requested data is an updated set 
of computer virus detecting data for use in detecting computer viruses. 

18. (cancelled) 
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19. (previously presented) A computer program product as claimed in claim 12, wherein 
said report data specifies one or more events and is sent together from said reporting computer to 
said receiving computer during providing of said requested data. 

20. (original) A computer program product as claimed in claim 12, wherein said report 
data is encrypted by said reporting computer and decrypted by said receiving con4)Uter, 

21 . (original) A computer program product as claimed in claim 12, wherein said reporting 
computer and said receiving computer communicate via an internet link, 

22. (original) A computer program product as claimed in claim 12, wherein said report 
data includes one or more of; 

a MAC address identifying a networic card of said reporting computer; 
a date of said event; 
a time of said event; 

an identifier of a computer program used by said reporting computer to detect said event; 
an identifier of a version of a computer program used by said reporting computer to 
detect said event; 

an identifier of a set of event detecting data used by a computer program used by said 
reporting computer to detect said event; 

an identifier of an event type detected by said reporting computer; and 

an action taken by said reporting computer upon detection of said event; and 

a checksum of a file that triggered said event. 

23. (previously presented) A method of controlling a reporting computer to report 
occurrence of an event to a receiving compirter, said method comprising the steps of: 

generating report data identifying said reporting computer and said event; 

fetching requested data from said receiving computer to said reporting computer upon a 
request of said reporting compiiter; and 

sending said report data from said reporting computer to said receiving comp\rter during 
fetching of said requested data; 
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wherein an internet URL is used to specify said requested data to said receiving 
computer, said internet URL specifying said requested data also containing said report data to be 
sent to said receiving computer. 

24. (original) A method as claimed in claim 23, wherein said event is detection of a 
computer file containing an unwanted computer program. 

25. (original) A method as claimed in claim 24, wherein said unwanted computer 
program is a computer vims. 

26. (original) A method as claimed in claim 23, wherein said requested data is a 
description of said event 

27. (original) A method as claimed in claim 23, wherein said event is detection of a 
computer file containing a computer virus and said requested data is a description of said 
computer virus. 

28. (original) A method as claimed in claim 23, wherein said event is detection of a 
computer file containing a computer virus and said requested data is an updated set of computer 
virus detecting data for use in detecting computer viruses. 

29. (cancelled) 

30. (previously presented) A method as claimed in claim 23, wherein said reportuig 
computer collates report data specifying one or more events that is sent together from said 
reporting computer to said receiving computer during fetching of said requested data. 

3 1 . (original) A method as claimed in claim 23, wherein said report data is encrypted by 
said reporting computer and decrypted by said receiving computer. 

32. (original) A method as claimed in claim 23, wherein said reporting computer and said 
receiving computer conmiunicate via an internet link. 
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33. (original) A method as claimed in claim 23, wherein said report data includes one or 
more of: 

a MAC address identifying a network card of said reporting computer; 
a date of said event; 
a time of said event; 

an identifier of a computer program used by said reporting computer to detect said event; 
an identifiet of a version of a computer program used by said reporting computer to 
detect said event; 

an identifier of a set of event detecting data used by a computer program used by said 
reporting computer to detect said event; 

an identifier of an event type detected by said reporting computer; 

an action taken by said reporting computer upon detection of said event; and 

a checksum of a file that triggered said event. 

34. (previously presented) A method of controlling a receiving computer to receive a 
report of occurrence of an event fi'om a reporting computer, said method comprising the steps of: 

receiving a request fot requested data fiom said reporting computer, 

providing said requested data to said reporting computer; and 

receiving report data identifying said reporting computer and said event from said 
reporting computer during providing of said requested data to said reporting computer, 

viiaerein an internet URL is used to specify said requested data to said receiving 
computer, said internet URL specifying said requested data also containing said report data to be 
sent to said receiving computer, 

35. (original) A method as claimed in claim 34, wherein said event is detection of a 
computer file containing an unwanted computer program. 

36. (original) A method as claimed in claim 35, wherein said unwanted computer 
program is a computer virus. 
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37. (original) A method as claimed in claim 34, wherein said requested data is a 
description of said event 

38. (original) A method as claimed in claim 34, wherein said event is detection of a 
computer file containing a computer virus and said requested data is a description of said 
computer virus. 

39. (original) A method as claimed in claim 34, wherein said event is detection of a 
computer file containing a computer virus and said requested data is an updated set of computer 
virus detecting data for use in detecting computer viruses. 

40. (cancelled) 

41 . (previously presented) A method as claimed in claim 34, wherein said report data 
specifies one or more events and is sent together fi-om said reporting computer to said receiving 
computer during providing of said requested data. 

42. (original) A method as claimed in claim 34, wherein said report data is enctypted by 
said reporting computer and decrypted by said receivtag computer. 

43. (original) A method as claimed in claim 34, wherein said reporting computer and said 
receiving computer communicate via an internet link. 

44. (original) A method as claimed in claim 34, wherein said report data includes one or 
more of: 

a MAC address identifying a network card of said reporting computer; 
a date of said event; 
a time of said event; 

an identifier of a computer program used by said reporting computer to detect said event; 
an identifier of a version of a computer program used by said reporting computer to 
detect said event; 
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an identifier of a set of event detecting data used by a computer program used by said 
reporting computer to detect said event; 

an identifier of an event type detected by said reporting computer; and 

an action taken by said reporting computer upon detection of said event; and 

a checksum of a file that triggered said event. 

45. (previously presented) A reporting computer operable to report occurrence of an 
event to a receiving computer, said teporting computer comprising: 

a report generator operable to generate report data identifying said reporting computer 
and said event; 

a data retriever operable to fetch requested data from said receiving computer to said 
reporting computer upon a request of said reporting computer; and 

a report sender operable to send said report data fi-om said reporting computer to said 
receiving computer during said fetch of said requested data; 

wherein an internet URL is used to specify said requested data to said receiving 
computer, said intemet URL specifying said requested data also containing said report data to be 
sent to said receiving computer. 

46. (original) A reporting computer as claimed in claim 45, wherein said event is 
detection of a computer file contaxoing an unwanted computer program. 

47. (original) A reporting computer as claimed in claim 46^ wherein said unwanted 
computer program is a computer virus. 

48. (original) A reporting computer as claimed in claim 45, wherein said requested data is 
a description of said event. 

49. (original) A reporting computer as claimed in claim 45, wherein said event is 
detection of a computer file containing a computer virus and said requested data is a description 
of said computer virus. 
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50. (original) A reporting computer as claimed in claim 45, Avhexein said event is 
detection of a computer file containing a computer virus and said requested data is an updated set 
of computer virus detecting data for use in detecting computer viruses, 

51. (canceUed) 

52. (previously presented) A reporting computer as claimed in claim 45, wherein said 
reporting computer collates report data specifying one or more events that is sent together firom 
said reporting computer to said receiving computer during said fetch of said requested data. 

53. (original) A reporting computer as claimed in claim 45, wherein said report data is 
encrypted by said reporting computer and decrypted by said receiving computer. 

54. (original) A reporting computer as claimed in claim 45, wherein said reporting 
computet and said receiving computer communicate via an internet link. 

55. (original) A reporting computer as claimed in claim 45, wherein said report data 
includes one or more of: 

a MAC address identifying a network card of said reporting computer; 
a date of said event; 
a time of said even^ 

an identifier of a computer program used by said reporting computer to detect said event; 
an identifier of a version of a computer program used by said reporting computer to 
detect said event; 

an identifier of a set of event detecting data used by a computer program used by said 
reporting computer to detect said event; 

an identifier of an event type detected by said reporting computer; 

an action taken by said reporting computer upon detection of said event; and 

a checksum of a file that triggered said event. 

56. (previously presented) A receiving computer operable to receive a report of 
occurrence of an event from a reporting computer, said receiving computer comprising: 
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a data request receiver operable to receive a request for requested data from said 
reporting computer; 

a data provider operable to provide said requested data to said reporting computer; and 
a report receiver operable to receive report data ideomtifying said reporting computer and 

said event from said reporting computer during providing of said requested data to said reporting 

computer; 

wherein an internet URJL is used to specify said requested data to said receiving 
computer, said internet URL specifying said requested data also containing said report data to be 
sent to said receiving computer, 

57. (original) A receiving computer as claimed in claim 56, wherein said event is 
detection of a computer file containing an unwanted computer program, 

58. (original) A receiving computer as claimed in claim 57, wherein said unwanted 
computer program is a computer virus. 

59. (original) A receiving computer as claimed in claim 56, wherein said requested data is 
a description of said event. 

60. (original) A receiving computer as claimed in claim 56, wherein said event is 
detection of a computer file containing a computer virus and said requested data is a description 
of said computer virus. 

61 . (original) A receiving computer as claimed in claim 56, wherein said event is 
detection of a computer jfile containing a comptiter virus and said requested data is an updated set 
of computer virus detecting data for use in detecting computer viruses. 

62. (cancelled) 

63. (previously presented) A receiving computer as claimed in claim 56, wherein said 
report data specifies one or more events and is sent together from said reporting computer to said 
receiving computer during providing of said requested data. 
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64. (original) A receiving computer as claimed in claim 56^ wherein said report data is 
encrypted by said reporting computer and decrypted by said receiving computer, 

65. (original) A receiving computer as claimed in claim 56, wherein said reporting 
computer and said receiving computer communicate via an internet link. 

66. (original) A receiving computer as claimed in claim 56, wherein said report data 
includes one or more of: 

a MAC address identifying a network card of said reporting computer; 
a date of said event; 
a time of said event; 

an identifier of a computer program used by said reporting computer to detect said event; 
an identifier of a version of a computer program used by said reporting computer to 
detect said event; 

an identifier of a set of event detecting data used by a computer program xxsed by said 
reporting computer to detect said event; 

an identifier of an event type detected by said reporting computer; and 

an action taken by said reporting computer upon detection of said event; and 

a checksum of a file that triggered said event. 

67. (previously presented) A computer program product as claimed ift claim 1, wherein 
said report data includes: 

a MAC address identifying a network card of said reporting computer; 
a date of said event; 
a time of said event; 

an identifier of a computer program used by said reporting computer to detect said event; 
an identifier of a version of a computer program used by said reporting computer to 
detect said event; 

an identifier of a set of event detecting data used by a computer program used by said 
reporting computer to detect said event; 

an identifier of an event type detected by said reporting computer; 
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an action taken by said reporting computer upon detection of said event; and 
a checksum of a file that triggered said event. 

68. (previoixsly presented) A computer program product as claimed in claim I, wherein 
said internet URL includes a name of a script running on said receiving computer and encrypted 
report data. 

69. (previously presented) A computer program product as claimed in claim 68, v^herein 
said script decrypts said encrypted report data. 

70. (Previously presented) A computer program product as claimed in claim 1, wherein 
said report data includes an identifier of a driver triggered during said event. 

71. (previously presented) A computer program product as claimed in claim 70, wherein 
said identifier of said driver is mapped to an identity of a virus that triggered said event. 

72. (previously presented) A computer program product as claimed in claim 1, wherein 
said URL is not displayed on said reporting computer^ 

73. (previously presented) A computer prograin product as claimed in claim 72, wherein 
said URL is in the form of a hypertext link that is associated with a description of said event. 

74. (previously presented) A computer program product as claimed in claim 73, wherein 
selection of said hypertext link results in a URL request being passed to said receiving computer. 
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IX EVIDENCE APPENDIX (37 C.F.R. § 41.37(c)(l)(ix)) 
There is no such evidence. 
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X RELATED PROCEEDING APPENDIX (37 C.F.IL § 41.37(c)(l)(x)) 

N/A 
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In the event a telephone conversation would expedite the prosecution of this application, the 
Examiner may reach the midersigned at (408) 971-2573. For payment of any additional fees due 
in connection with the filing of this paper, the Conraiissiooer is authorized to charge such fees to 
Deposit Account No. 50-1351 (OrderNo.NAIlP459/01.021.01). 




San Jose, California 95172-1 120 
Telephone: (408) 971-2573 
Facsimile: (408)971-4660 
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